Attacker used prompt injection on an AI vendor's evaluation sandbox to take production API keys
What happened
Anthropic's September threat report says a Russian-speaking, financially motivated actor injected instructions into an AI vendor's automated evaluation sandbox and got stored production API keys from several providers. It then used the keys and launched a follow-on campaign against about 30 AI companies, but did not reach a pre-release Claude model.
The actor previously breached hotel booking and fintech platforms and in one intrusion took about 26 GB of data and sought 1.5 to 2.5 million dollars. In the AI case it used prompt injection against an AI vendor's automated evaluation sandbox, which handed over its stored credentials, including production keys from multiple AI providers. The actor moved its own workloads onto the keys and kept attacking the vendor and unrelated targets. From the same infrastructure it launched a campaign against roughly 30 AI companies over about four days, repeating one working path with small changes. It was after a pre-release Claude model, pursued it across more than a dozen avenues and never gained access.
How it happened
Manipulated AI: Prompt injection. Hidden instructions planted in content the AI was reading, such as an email, web page or issue, made it act for the attacker.
Models from several AI vendors were involved. The product type was AI-powered app.
Impact
Data was exposed. Data involved: credentials. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
Unclear. Sources do not establish whether the model's own behaviour or the surrounding systems were to blame.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 10 Sep 2026.
The report says Anthropic's own systems were never compromised and that Anthropic disrupted the activity it describes in its cyber cases. It describes no step specific to this actor.